Ask Your Question

tshark: How do I convert pcap to compressed pcapng?

asked 2018-07-16 22:20:05 +0000

gourdcaptain gravatar image

How do I from the command line convert a standard uncompressed pcap file to a compressed pcapng file? None of the manual entries I can find explain how to do the same pcapng compression offered in the save dialogues in the GUI version of Wireshark.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-07-17 03:39:05 +0000

Guy Harris gravatar image

At least on a system with a gzip command, you can do it with

editcap -F pcapng {pcap file} - | gzip >{gzipped pcapng file}
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-07-16 22:20:05 +0000

Seen: 1,787 times

Last updated: Jul 17 '18